Python: filter more sinks in stdlib

Rename variable to reflect larger scope

We had test results inside `os.py`, I suppose we have found a little extra flow.
This commit is contained in:
Rasmus Lerchedahl Petersen
2023-11-20 16:56:19 +01:00
parent 11c71fdd18
commit 421d4f3497

View File

@@ -71,11 +71,11 @@ module PathInjection {
// ```
//
// The same approach is used in the command injection query.
not exists(Module pathlib |
pathlib.getName() = "pathlib" and
this.getScope().getEnclosingModule() = pathlib and
// do allow this call if we're analyzing pathlib.py as part of CPython though
not exists(pathlib.getFile().getRelativePath())
not exists(Module inStdlib |
inStdlib.getName() in ["pathlib", "os"] and
this.getScope().getEnclosingModule() = inStdlib and
// do allow this call if we're analyzing, say, pathlib.py as part of CPython though
not exists(inStdlib.getFile().getRelativePath())
)
}
}